Open source

The parts worth checking are the parts we publish

Not everything is open, and the split is not arbitrary. The components that make claims you would otherwise have to take on trust — how risk is enforced, how costs are modelled, what an event actually contains — are public. The models and the hosted platform are not.

What is public

Four repositories, two licences, and a reason for each.

  • risk-engine-specApache-2.0

    The thirteen responsibilities, written as an executable specification.

    A risk system you cannot inspect is a risk system you are taking on faith. The spec and its conformance suite are public so the behaviour can be checked rather than believed — including by people who never use the platform.

  • event-envelopeApache-2.0

    The envelope format, registry and replay semantics used on the internal bus.

    It is also the webhook payload format. Publishing it means an integrator can generate types and test against a real schema instead of reverse-engineering examples.

  • backtest-harnessApache-2.0

    Cost modelling, walk-forward windowing and the parameter-surface reporter.

    Backtest results are only meaningful if you can see how costs were modelled. This is the part where the numbers are made, so it is the part most worth being open.

  • nexus-clientsMIT

    The Python, TypeScript, Go and Rust SDKs, plus the generator that produces them.

    Client libraries live in your codebase, so they should be readable, forkable and patchable without waiting for us.

What is not, and why

The model ensemble

The structure, momentum and analogue-recall models and their calibration are closed. They are the product. Their inputs and outputs are fully inspectable per decision, which is the property that actually matters to someone deciding whether to trust a verdict.

The hosted platform

Deployment, tenancy and key custody are closed for the ordinary reason: publishing the exact shape of the system that holds trading credentials makes it easier to attack and no easier to verify.

We would rather state this boundary plainly than describe the project as "open source" and let the ambiguity do work. What is open is genuinely open — Apache-2.0 and MIT, no commons clause, no source-available licence pretending otherwise.

Contributing

Small and specific beats large and speculative. A failing test that reproduces a bug is the most useful thing you can send.

get set up
git clone https://github.com/tradelogx/risk-engine-spec
cd risk-engine-spec
make install          # dev dependencies and hooks
make test             # the conformance suite, ~40s
make test-watch       # while you work

Licence

Contributions are under the repository's licence. No CLA — a DCO sign-off on each commit is enough.

Review

Two maintainers on anything touching risk semantics, one on everything else. Reviews are public.

Releases

Tagged from main, changelog derived from commits, published to PyPI, npm, pkg.go.dev and crates.io.

Where the repositories live and what a good issue looks like is covered on the GitHub page. Security issues are the exception to all of this — never open a public issue for one; the disclosure route is on the security page.